Re: Using BIND-DLZ for a hidden master [was: Re: dns master-slave transfer]

2012-11-01 Thread Jan-Piet Mens
Chris, Can one use BIND 9.9 inline signing with the unsigned version provided by a DLZ interface? there's no reason why you shouldn't be able to. Your BIND 9.9 inline signer would AXFR from BIND DLZ without trouble, but your signer won't be notified by DLZ; you'd have to manually issue NOTIFY

Re: Using BIND-DLZ for a hidden master [was: Re: dns master-slave transfer]

2012-11-01 Thread Peter Andreev
2012/11/1 Chris Thompson c...@cam.ac.uk: On Oct 29 2012, Feng He wrote: 于 2012-10-29 9:58, kavin 写道: Now,I want transfer the zone data from the master dns serverto slave dns server ,the master dns use bind-dlz+mysql and the slave dns server use bind+file. AFAIK, BIND DLZ doesn't send a

Re: Delegations

2012-11-01 Thread Sam Wilson
In article mailman.564.1351726720.11945.bind-us...@lists.isc.org, Mark Andrews ma...@isc.org wrote: In message 5091adef.1040...@dougbarton.us, Doug Barton writes: On 10/31/2012 03:56 PM, Mark Andrews wrote: You are equating a practice that was techically wrong, and known to be wrong

Re: BIND and DNSSEC

2012-11-01 Thread Alan Clegg
On Nov 1, 2012, at 3:02 AM, Kobus Bensch kben...@fullnet.co.uk wrote: Thank you for this. Had a look and it seems fairly easy. Not sure if that is a flippant remark. As the author of this document, I must say thanks. Deploying DNSSEC is not hard. It's the care and feeding after-the-fact

Re: Delegations

2012-11-01 Thread Jan-Piet Mens
YPYMAYTYP Zero results from my favorite search engine -- congratulations. ;-) -JP ___ Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list bind-users mailing list bind-users@lists.isc.org

Re: Delegations

2012-11-01 Thread Sam Wilson
In article mailman.571.1351768172.11945.bind-us...@lists.isc.org, Jan-Piet Mens jpmens@gmail.com wrote: YPYMAYTYP Zero results from my favorite search engine -- congratulations. ;-) Thank you. Try YPYMAYTYC but I was thinking pick. Sam -- The University of Edinburgh is a charitable

Re: BIND and DNSSEC

2012-11-01 Thread Kobus Bensch
Hi Is that because split horizon doubles admin or because its bad all together? I have been using split horizon for many years now and found it very useful. Any thoughts from any on the list would be most welcomed. Kobus - Original Message - From: Alan Clegg a...@clegg.com To: Kobus

Re: BIND and DNSSEC

2012-11-01 Thread Alan Clegg
On Nov 1, 2012, at 7:14 AM, Kobus Bensch kben...@fullnet.co.uk wrote: Is that because split horizon doubles admin or because its bad all together? I have been using split horizon for many years now and found it very useful. Any thoughts from any on the list would be most welcomed. Crafted

Re: BIND and DNSSEC

2012-11-01 Thread Tony Finch
Feng He fen...@nsbeta.info wrote: Take a look at: http://www.dnssec.lk/docs/DNSSEC_in_6_minutes.pdf I recommend using auto-dnssec maintain so named keeps the zone signed, instead of dnssec-signzone. Tony. -- f.anthony.n.finch d...@dotat.at http://dotat.at/ Forties, Cromarty: East, veering

Re: BIND and DNSSEC

2012-11-01 Thread Kobus Bensch
Thanks. All makes sense and definitely something to think about in the new network design. Also wanted to say, I did like the doc and will be using that, but as you say, will make particular note about the maintenance side of things. Thanks Kobus - Original Message - From: Alan Clegg

Re: BIND and DNSSEC

2012-11-01 Thread Alan Clegg
On Nov 1, 2012, at 7:34 AM, Tony Finch d...@dotat.at wrote: I recommend using auto-dnssec maintain so named keeps the zone signed, instead of dnssec-signzone. I do as well, and this will be documented in the next version of this document. AlanC -- Alan Clegg | +1-919-355-8851 |

Re: BIND and DNSSEC

2012-11-01 Thread Alan Clegg
On Nov 1, 2012, at 7:34 AM, Tony Finch d...@dotat.at wrote: I recommend using auto-dnssec maintain so named keeps the zone signed, instead of dnssec-signzone. I do as well, and this will be documented in the next version of this document. AlanC -- Alan Clegg | +1-919-355-8851 |

Re: BIND and DNSSEC

2012-11-01 Thread Alan Clegg
On Nov 1, 2012, at 7:34 AM, Tony Finch d...@dotat.at wrote: I recommend using auto-dnssec maintain so named keeps the zone signed, instead of dnssec-signzone. I do as well, and this will be documented in the next version of this document. AlanC -- Alan Clegg | +1-919-355-8851 |

Re: BIND and DNSSEC

2012-11-01 Thread Chris Thompson
On Nov 1 2012, Jan-Piet Mens wrote: I do as well, and this will be documented in the next version of this document. I believe you've mentioned that here before. Several times. Today. ;-)  What I tell you three times is true.” The Bellman, pp Lewis Carroll -- Chris Thompson Email:

Re: BIND and DNSSEC

2012-11-01 Thread Sten Carlsen
On 01/11/12 12:26, Alan Clegg wrote: On Nov 1, 2012, at 7:14 AM, Kobus Bensch kben...@fullnet.co.uk wrote: Is that because split horizon doubles admin or because its bad all together? I have been using split horizon for many years now and found it very useful. Any thoughts from any on the

Re: Delegations

2012-11-01 Thread Chris Buxton
On Oct 31, 2012, at 4:02 PM, Doug Barton wrote: On 10/31/2012 03:56 PM, Mark Andrews wrote: You are equating a practice that was techically wrong, and known to be wrong from the get go, with one that has never been techically wrong. Yes, I'm making exactly the same judgment that typical

Bind 9.9.2 Clarification

2012-11-01 Thread Manson, John
Should I install bind 9.9.0 first and then update to bind 9.9.1 then update to bind 9.9.2? This excerpt from the README file is a little confusing: BIND 9.9.2 BIND 9.9.2 is a maintenance release and patches the security flaw described in CVE-2012-4244. BIND 9.9.1 BIND

Re: Bind 9.9.2 Clarification

2012-11-01 Thread Doug Barton
You can install 9.9.2 directly. Doug On 11/01/2012 01:30 PM, Manson, John wrote: Should I install bind 9.9.0 first and then update to bind 9.9.1 then update to bind 9.9.2? This excerpt from the README file is a little confusing: BIND 9.9.2 BIND 9.9.2 is a maintenance release

Re: BIND and DNSSEC

2012-11-01 Thread Alan Clegg
On Nov 1, 2012, at 7:45 AM, Alan Clegg a...@clegg.com wrote: On Nov 1, 2012, at 7:34 AM, Tony Finch d...@dotat.at wrote: I recommend using auto-dnssec maintain so named keeps the zone signed, instead of dnssec-signzone. I do as well, and this will be documented in the next version of

Re: BIND and DNSSEC

2012-11-01 Thread Barry S. Finkel
On 11/1/2012 3:31 PM, Sten Carlsen st...@s-carlsen.dk wrote: The typical server setup (for own servers) is that one name is used for setting up e.g. the mail server, the ideal situation for everybody is that whether I am in house or visiting you, if I have any internet access, I can read and

Re: BIND and DNSSEC

2012-11-01 Thread Sten Carlsen
On 02/11/12 2:08, Barry S. Finkel wrote: On 11/1/2012 3:31 PM, Sten Carlsen st...@s-carlsen.dk wrote: The typical server setup (for own servers) is that one name is used for setting up e.g. the mail server, the ideal situation for everybody is that whether I am in house or visiting you, if I